MalformedPolicy: Policy has invalid resource about cloudgoat HOT 6 CLOSED

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
              "Service": "cloudtrail.amazonaws.com"
            },
            "Action": "s3:GetBucketAcl",
            "Resource": "arn:aws:s3:::${var.cloudgoat_private_bucket_name}"
        },
        {
            "Effect": "Allow",
            "Principal": {
              "Service": "cloudtrail.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::${var.cloudgoat_private_bucket_name}/*",
            "Condition": {
                "StringEquals": {
                    "s3:x-amz-acl": "bucket-owner-full-control"
                }
            }
        }
    ]
}

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Principal": {
                  "Service": "cloudtrail.amazonaws.com"
                },
                "Action": "s3:GetBucketAcl",
                "Resource": "arn:aws:s3:::"
            },
            {
                "Effect": "Allow",
                "Principal": {
                  "Service": "cloudtrail.amazonaws.com"
                },
                "Action": "s3:PutObject",
                "Resource": "arn:aws:s3:::/*",
                "Condition": {
                    "StringEquals": {
                        "s3:x-amz-acl": "bucket-owner-full-control"
                    }
                }
            }
        ]
    }

variable "cloudgoat_private_bucket_name" {
  default = "cloudgoat-bucket-private"
}

-/+ aws_s3_bucket.cloudgoat_private (new resource required)
      id:                            "terraform-20180802133524191600000001" => <computed> (forces new resource)
      acceleration_status:           "" => <computed>
      acl:                           "private" => "private"
      arn:                           "arn:aws:s3:::terraform-20180802133524191600000001" => <computed>
      bucket:                        "terraform-20180802133524191600000001" => "g6" (forces new resource)
      bucket_domain_name:            "terraform-20180802133524191600000001.s3.amazonaws.com" => <computed>
2018-08-02T08:46:19.904-0500 [DEBUG] plugin: plugin process exited: path=/Users/kbroughton/praetorian-tools/cloudgoat/terraform/.terraform/plugins/darwin_amd64/terraform-provider-aws_v1.29.0_x4
      bucket_regional_domain_name:   "terraform-20180802133524191600000001.s3.us-west-2.amazonaws.com" => <computed>
      force_destroy:                 "true" => "true"
      hosted_zone_id:                "Z3BJ6K6RIION7M" => <computed>
      policy:                        "" => "{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n              \"Service\": \"cloudtrail.amazonaws.com\"\n            },\n            \"Action\": \"s3:GetBucketAcl\",\n            \"Resource\": \"arn:aws:s3:::g6\"\n        },\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n              \"Service\": \"cloudtrail.amazonaws.com\"\n            },\n            \"Action\": \"s3:PutObject\",\n            \"Resource\": \"arn:aws:s3:::g6/*\",\n            \"Condition\": {\n                \"StringEquals\": {\n                    \"s3:x-amz-acl\": \"bucket-owner-full-control\"\n                }\n            }\n        }\n    ]\n}\n"
      region:                        "us-west-2" => <computed>
      request_payer:                 "BucketOwner" => <computed>
      versioning.#:                  "1" => <computed>
      website_domain:                "" => <computed>
      website_endpoint:              "" => <computed>